TeamUpdraft Breach Lets Attackers Backdoor WordPress Sites
October 20, 2026
Attackers who breached TeamUpdraft used stolen UpdraftCentral keys to plant backdoor plugins on WordPress sites, Patchstack found; fixed releases are
Cybersecurity
TeamUpdraft Breach Lets Attackers Backdoor WordPress Sites
Attackers who breached TeamUpdraft used stolen UpdraftCentral keys to plant backdoor plugins on WordPress sites, Patchstack found; fixed releases are out.
Siemens Software Center Flaw Exploited in ROMULUS ClickFix Attacks
Siemens confirmed attackers exploited CVE-2026-110936 in Software Center, bundling a signed copy with malicious DLLs in the ROMULUS ClickFix campaign.
Laravel TokenGuard Flaw Lets Attackers Log In as Any User
Laravel disclosed a critical TokenGuard authentication bypass rated CVSS 9.2 that affects MySQL and MariaDB apps, plus a moderate data-loss flaw; patches exist.
Roundcube 1.6.20 and 1.7.5 Fix 20 Flaws, Including IMAP Injection
Roundcube released 1.6.20 and 1.7.5 to fix 20 flaws, including IMAP command injection, header injection, XSS, SSRF and CSRF; no exploitation is confirmed.
Citizen Lab Confirms Pegasus on Belgrade Rector’s Phone Before Vote
Citizen Lab confirmed NSO Group's Pegasus spyware on the phone of Belgrade university rector Vladan Djokic days before Serbia's October 25 elections.
AIA0001 Hacker Uses AI Agents to Breach 100+ Company Websites
NorForge says a Chinese-speaking operator used autonomous AI agents to compromise more than 100 e-commerce sites, including Deere, SharkNinja and Cummins.
Parkview Health Disables Network After Suspicious Activity
Parkview Health took its network offline over suspicious activity, knocking out MyChart across Indiana and Ohio. The cause is not confirmed as a cyberattack.
Plex2Shell Exploit Chain Hits Plex Servers a Day After PoC Release
Attackers began exploiting the Plex2Shell chain of four CVEs in Plex Media Server a day after a public proof-of-concept, dropping a cryptominer and proxy tool.
Microsoft Confirms Windows Update Breaks Exchange Sign-In, Mail Flow
Microsoft confirmed October Windows Server updates cause OWA sign-in failures and stuck mail on on-premises Exchange servers; a fix is still pending.
OpenCode Console Breach May Have Exposed Saved AI Provider API Keys
An intruder reached a legacy OpenCode system, possibly exposing OpenAI, Anthropic and Google API keys saved by 1.4% of Console users; some report charges.
Siemens Software Center Flaw Exploited in ROMULUS ClickFix Attacks
October 20, 2026
Siemens confirmed attackers exploited CVE-2026-110936 in Software Center, bundling a signed copy with malicious DLLs in the ROMULUS ClickFix campaign.
Laravel TokenGuard Flaw Lets Attackers Log In as Any User
October 20, 2026
Laravel disclosed a critical TokenGuard authentication bypass rated CVSS 9.2 that affects MySQL and MariaDB apps, plus a moderate data-loss
Roundcube 1.6.20 and 1.7.5 Fix 20 Flaws, Including IMAP Injection
October 20, 2026
Roundcube released 1.6.20 and 1.7.5 to fix 20 flaws, including IMAP command injection, header injection, XSS, SSRF and CSRF; no
Citizen Lab Confirms Pegasus on Belgrade Rector’s Phone Before Vote
October 20, 2026
Citizen Lab confirmed NSO Group’s Pegasus spyware on the phone of Belgrade university rector Vladan Djokic days before Serbia’s October
AIA0001 Hacker Uses AI Agents to Breach 100+ Company Websites
October 20, 2026
NorForge says a Chinese-speaking operator used autonomous AI agents to compromise more than 100 e-commerce sites, including Deere, SharkNinja and
Parkview Health Disables Network After Suspicious Activity
October 20, 2026
Parkview Health took its network offline over suspicious activity, knocking out MyChart across Indiana and Ohio. The cause is not
Plex2Shell Exploit Chain Hits Plex Servers a Day After PoC Release
October 19, 2026
Attackers began exploiting the Plex2Shell chain of four CVEs in Plex Media Server a day after a public proof-of-concept, dropping
Microsoft Confirms Windows Update Breaks Exchange Sign-In, Mail Flow
October 19, 2026
Microsoft confirmed October Windows Server updates cause OWA sign-in failures and stuck mail on on-premises Exchange servers; a fix is
OpenCode Console Breach May Have Exposed Saved AI Provider API Keys
October 19, 2026
An intruder reached a legacy OpenCode system, possibly exposing OpenAI, Anthropic and Google API keys saved by 1.4% of Console
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.